XCSSET v40 Abuses Chrome DevTools Protocol to Steal Cookies and Run Commands

XCSSET has returned with a way to target macOS developers. The latest version, v40, hides inside poisoned Xcode projects and can turn a local build into a supply-chain compromise.

Once activated, it can spread through other projects, raising risk for developers and the organizations that use their code.

The malware family was first documented in 2020, but its campaign shows a move toward stealth and scale. It uses memory-based execution, changing payloads, and short-lived files to reduce visible traces.

Developers across South Asia have seen heightened targeting, while infected projects have appeared in open-source repositories and workflows.

Unit 42 analysts identified the v40 activity in mid-April 2026 and observed a second wave in early May with more operational modules. 

Palo Alto Networks said in a report shared with Cyber Security News (CSN) that the campaign had embedded XCSSET in Xcode projects tied to dozens of applications with active users.

The danger lies in the trust placed in development tools. A compromised project may look normal until someone builds it, when a hidden script contacts attackers and fetches more code.

That makes careful review of project settings as important as reviewing source, a lesson also reflected in earlier coverage of XCSSET project infections.

XCSSET v40 adds a Chrome-hijacking backdoor that abuses Chrome DevTools Protocol, or CDP, a legitimate browser automation interface.

The malware wraps the real Chrome application in a malicious launcher. Each time Chrome opens, the launcher restarts XCSSET, enables CDP on a local port, and runs a helper binary called chrome_remote.

That helper connects to the exposed local CDP service and can run JavaScript inside active browser sessions. It can collect cookie tokens, watch web-request traffic, capture password-manager autofill data, and interfere with crypto-wallet transactions.

The technique abuses a trusted browser feature rather than a browser flaw, making the context behind recent Chrome DevTools security updates useful.

The same browser channel can provide remote command execution. Operators send a specially marked console event, chrome_remote extracts the command, passes it to the macOS shell, then returns output through the CDP WebSocket connection.

The result is a fileless reverse shell running through a legitimate Chrome process, making traditional file-focused checks less effective.

The “Chrome-hijacking backdoor’s execution chain,” shows the relationship between the boot orchestrator, browser hijacker, chrome_remote process, and localhost:18907.

Researchers reported the behavior to Google; protections exist on Windows, and work to extend those protections to macOS was underway at the time of the report.

Stealth, persistence, and defense steps

Beyond the browser backdoor, the framework contains 17 modules and a new Telegram Desktop trojanizer. The latter can remove a genuine application, install an attacker-supplied replacement, sign it ad hoc, and prompt the user to reopen it.

This reflects a broader trend in which malicious repositories abuse familiar developer workflows, as seen in reporting on weaponized Git hooks.

XCSSET also changes its code and encrypted payloads frequently, retains much of its activity in memory, and uses macOS preferences to store re-infection data.

It attempts to disrupt updates and security telemetry, lock the XProtect database, and reset automation-permission decisions. These steps can leave users facing prompts that appear to come from Xcode or system settings.

Unit 42 recommends watching for unusual AppleScript activity, unexpected browser launch paths, unauthorized writes, and abnormal preferences domains created with the defaults utility.

Teams should isolate ad hoc-signed binaries that evade normal trust checks, scan dependencies before importing them, and inspect Xcode projects for unfamiliar build phases or scripts.

Similar caution is warranted with fake GitHub developer tools, particularly before running setup commands.

For defenders, the warning is simple: do not treat a build environment as inherently safe. Monitor behavior across repositories, endpoints, browsers, and network connections, then investigate unexplained Chrome launches with debugging enabled.

Updating macOS and Chrome, validating project provenance, and limiting automation permissions can reduce the opportunities XCSSET v40 relies on.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
C2 Domain	accapple[.]ru	adschecks[.]ru	adsmobi[.]ru	adsmorein[.]in	adsmoreme[.]in	amdcdn[.]ru	amzndev[.]in	amzndev[.]ru	amznprod[.]in	applecdn[.]ru	appledisk[.]ru	appledns[.]ru	applehosts[.]ru	appletime[.]in	bulksec[.]ru	cdnamz[.]in	XCSSET v40 command-and-control domains
C2 Domain	cdnamz[.]ru	cdnapple[.]in	cdnatapple[.]ru	cdnroute[.]ru	checkcdn[.]ru	chromeads[.]ru	cnmag[.]ru	devnetaps[.]ru	dnsapple[.]ru	dnsrelays[.]ru	explorecdn[.]ru	fiddlejoy[.]ru	figmacat[.]ru	figmanets[.]in	funchats[.]ru	gironetcdn[.]ru	XCSSET v40 command-and-control domains
C2 Domain	goalmate[.]ru	googlenets[.]ru	greencn[.]ru	icloudsnet[.]ru	imails[.]ru	legalads[.]in	littleads[.]in	littledns[.]ru	maganet[.]ru	mindelgate[.]ru	netapsdev[.]ru	netcdnads[.]in	netcdnamz[.]ru	netcdndev[.]in	netcorps[.]ru	netsprot[.]in	XCSSET v40 command-and-control domains
C2 Domain	netsproto[.]in	networkads[.]in	rigacdn[.]in	rigmajoys[.]in	rigmanet[.]ru	rigmanets[.]in	sahusuzuki[.]in	stuffdns[.]in	testjoys[.]ru	timewebnet[.]in	vigmanet[.]ru	whitead[.]in	whiteads[.]ru	wincdn[.]ru	windsecure[.]ru	XCSSET v40 command-and-control domains
C2 URL	hxxps[:]//amzndev[.]in/d/zw_sfp64	hxxps[:]//amzndev[.]ru/d/zw_sfp64	hxxps[:]//googlenets[.]ru/d/zw_sfp64	hxxps[:]//netcdndev[.]in/d/zw_sfp64	hxxps[:]//whitead[.]in/d/zw_sfp64	hxxps[:]//whiteads[.]ru/d/zw_sfp64	Chrome CDP helper-binary download locations
C2 IP Address	91.108.106[.]229	95.142.35[.]34	95.142.35[.]206	95.142.37[.]159	151.243.109[.]188	178.208.92[.]129	178.208.92[.]168	XCSSET v40 command-and-control infrastructure
SSL Thumbprint	6e480d648fa1b70612f5d198a66875e28847547d	Shared SSL certificate thumbprint associated with operator infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Building Resilience Against Phishing & Malware and Analyze it in a safe environment – Power your SOC with ANY.RUN